$re = '/^(\w+)\s+(\w+)[\w\/-]*[-\/](\w+)$/m';
$str = 'root 111 /sbin/ksh
root24 1 -bash
root 111 /ksh/init
root11 345 ksh
aaaa 123 /a/n/g/h';
$subst = "\\1";
$result = preg_replace($re, $subst, $str);
echo "The result of the substitution is ".$result;
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php